Rust: Add string slice taint flow test

This commit is contained in:
Simon Friis Vindum
2024-12-04 13:24:15 +01:00
parent 2ada999728
commit 70a296be89
3 changed files with 23 additions and 0 deletions

View File

@@ -0,0 +1,4 @@
import codeql.rust.dataflow.DataFlow
import codeql.rust.dataflow.internal.TaintTrackingImpl
query predicate additionalTaintStep = RustTaintTracking::defaultAdditionalTaintStep/3;

View File

@@ -24,8 +24,27 @@ fn cast() {
sink(b as i64); // $ MISSING: hasTaintFlow=77
}
mod string {
fn source(i: i64) -> String {
format!("{}", i)
}
fn sink(s: &str) {
println!("{}", s);
}
pub fn string_slice() {
let s = source(35);
let sliced = &s[1..3];
sink(sliced); // $ MISSING: hasTaintFlow=35
}
}
use string::*;
fn main() {
addition();
negation();
cast();
string_slice();
}